> For the complete documentation index, see [llms.txt](https://kashz.gitbook.io/hackthebox-writeups/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://kashz.gitbook.io/hackthebox-writeups/htb-boxes/admirer.md).

# ADMIRER

## Summary

This box has a old version of PhpMyAdmin (adminer.php) hosted on port 80, which has a known vulnerability allowing remote connections to a MySQL server and allowing to run local queries to read files. Using LFI, we can read `index.php` to obtain creds which allow SSH access on target. Abusing sudo with setting env\_vars and python library allows for privilege escalation to root.